Fake Calendar Invites Can Infect Your System How to Protect Yourself
Fake Calendar Invites Can Infect Your System: How to Protect Yourself 🚨
Have you ever received a calendar invite via email that turned out to be fake and even malicious? Many email programs automatically add an invite to your calendar before you can even accept or decline it. A new report from cybersecurity firm Sublime highlights a dramatic rise in these calendar-based malware attacks. Over the past few months, such attacks rose by 282% in June over the prior month, by 338% in July, and by a whopping 1,216% in August. For September, the firm projects a 2,852% increase over August! 📈
To pull off these attacks, scammers use a technique that Sublime calls ICS phishing. Part of the iCalendar standard, an ICS file contains the details for a meeting or appointment invitation. In programs such as Microsoft Outlook, Gmail, and Apple Mail, an ICS file sent via email can automatically be added to your calendar before you even decide to accept or decline the invite.
Why Are These Scams Successful? 🤔
These types of scams prove successful for several reasons. The meeting invites are sent to both your inbox and your calendar, exposing you in two places. Most email programs are designed to prevent attacks in your inbox, but not your calendar. Even if the email itself is caught by security software, the event is added to your calendar and often remains there.
Most of these attacks are deployed using Google’s platform, meaning Gmail via Google Calendar. Many are also sent via Microsoft’s infrastructure. Both are trusted services that can evade detection. As John Gallagher, VP at cyber hygiene provider Viakoo, noted, “What makes these attacks successful is the implied trust – both systems involved and of the invitation itself… The danger is with what is inside the invite; links or QR codes can compromise the victim’s system, and even rejecting the invite can send the attacker information on the email address being valid.”
For example, one recent attack highlighted by Sublime used a Google Calendar invite to deliver a link to a malicious remote monitoring and management (RMM) payload. The email itself employed a known financial lure tactic, tempting users with an alleged credit against a recent invoice. Should the intended victim click on the link in the email or calendar entry, they’d be taken to a page hosted by Framer, prompting them to click a View Here button to download the alleged credit note, which actually links to a malicious file. Beyond containing malware, the MSI file includes configuration information that exploits the legitimate remote access ScreenConnect tool to act as a Command and Control server.
Best Defense Against These Attacks 🛡️
The best defense against these attacks involves proactive measures. Shane Barney, Chief Information Security Officer at cybersecurity software Keeper Security, advises:
- Never click on links, RSVP, or even click Decline because it confirms your email is active.
- Instead, delete the event directly and report it as spam if your email provider has the feature.
- Tighten your calendar settings by disabling the setting that automatically adds invitations to your calendar from unknown senders.
For instance, Gmail users can adjust “Add invitations to my calendar” to “Only if the sender is known” or “When I respond to the invitation in email.” Similarly, in classic Microsoft Outlook, users can uncheck options for automatically processing meeting requests and accepting meeting requests.
Mark Morris, threat detection engineer at Sublime Security, also suggests:
- Scrutinizing the sender’s email address and domain name.
- Avoiding suspicious links.
- Being wary of urgent prompts.
- Never authenticating your account from a calendar invite.
Crucially, never respond to the email or meeting invite; instead, report them as phishing attempts and delete them, as attackers often look for live inboxes.
For more information, check out the full article here: Read full article